PT-2022-26699 · Unknown · Train Scheduler App

Published 2022-10-27 · Updated 2024-02-14 · CVE-2022-42992

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Train Scheduler App version 1.0

Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Train Code, Train Name, and Destination text fields. This enables the execution of malicious scripts, potentially leading to unauthorized actions on the affected system.

Recommendations For Train Scheduler App version 1.0, consider disabling the text fields for Train Code, Train Name, and Destination to prevent the injection of malicious payloads until a fix is available. Restrict access to these fields to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-42992

Affected Products

Train Scheduler App

References · 6

• 🔥 https://github.com/draco1725/POC/blob/main/Exploit/Train%20Scheduler%20App/XSS · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-42992 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42992 · Vendor Advisory
• https://t.me/cibsecurity/52152 · Telegram Post
• http://oretnom23.com · Note
• http://train.com · Note